GOLD BURLAP

Executive Summary

GOLD BURLAP, also known as CYBORG SPIDER, is a financially motivated threat actor group responsible for the development and deployment of the Pysa ransomware (also referred to as Mespinoza). The group primarily targets healthcare organizations, leveraging sophisticated tactics such as 'name and shame' strategies to pressure victims into paying ransoms. While no advertisements for Pysa have been found on underground forums, indicating it is not a ransomware-as-a-service (RaaS) product, the group remains active and poses a significant threat to critical infrastructure.

Goals & Targeting

GOLD BURLAP's primary strategic objective is financial gain through ransomware activities. While their targeting focus has included healthcare organizations due to the sector's sensitive data and potential for high-ransom demands, the group’s broader targeting patterns remain unclear. Their victims appear to be selected based on ease of access rather than specific geopolitical or industry-related factors. The use of 'name and shame' tactics indicates a sophisticated understanding of victim psychology and pressure points.

GOLD BURLAP is a cybercriminal organization specializing in the development and operation of the Pysa ransomware. This ransomware is cross-platform, with known versions developed using C++ and Python. As of December 2020, approximately 50 organizations across various industries were reported to have fallen victim to Pysa attacks. The group's primary motivation appears to be financial gain, achieved through the encryption of victims' data and subsequent demands for payment in exchange for decryption keys or files. The operators behind GOLD BURLAP employ 'name and shame' tactics to increase pressure on targeted organizations, often publicly naming uncooperative victims and sharing stolen data to further coerce payments. This approach is particularly concerning for healthcare organizations, which may face additional risks to patient trust and data privacy. The lack of Pysa advertisements on underground forums suggests that the group operates independently rather than as a RaaS offering, implying a more centralized and controlled operation.

Key Capabilities

• Development and deployment of Pysa ransomware
• 'Name and shame' extortion tactics
• Encryption of sensitive data
• Cross-platform ransomware capabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GOLD BURLAP's campaigns typically involve targeted attacks against healthcare organizations, leveraging phishing or remote access vectors to deploy Pysa. The group operates with a moderate operational tempo, focusing on stealth and persistence to avoid detection. Notable past operations include the December 2020 wave of attacks affecting healthcare entities. Campaigns often involve the encryption of critical systems followed by the publication of victim data to maximize pressure on organizations. Despite their relative lack of visibility in underground forums, the group’s focus on a specific geographic or sectoral targeting strategy remains underdetailed in available intelligence.

IOC Patterns

• Spear-phishing emails with malicious links or attachments
• Encrypted files with .pysa extensions
• Network traffic related to Pysa's command-and-control infrastructure
• Presence of Pysa malware indicators on compromised systems

Recommended Actions

• Implement multi-factor authentication for RDP and other remote access services
• Conduct regular patch management and system updates to prevent known vulnerabilities from being exploited
• Train employees to recognize phishing attempts and suspicious emails
• Encrypt sensitive data with strong encryption standards and maintain offline backups
• Develop and implement incident response plans specific to ransomware attacks

Suggested Tags